Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
amazonAmazonALAS2-2023-2192
HistoryAug 03, 2023 - 6:10 p.m.

Important: cni-plugins

2023-08-0318:10:00
alas.aws.amazon.com
23
cni-plugins http2/hpack vulnerability
al2 core
yum update
new packages
cve-2022-41723

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

8

Confidence

High

EPSS

0.03

Percentile

91.0%

JSON

Issue Overview:

http2/hpack: avoid quadratic complexity in hpack decoding (CVE-2022-41723)

Affected Packages:

cni-plugins

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update cni-plugins to update your system.

New Packages:

aarch64:  
    cni-plugins-1.2.0-1.amzn2.0.2.aarch64  
    cni-plugins-debuginfo-1.2.0-1.amzn2.0.2.aarch64  
  
src:  
    cni-plugins-1.2.0-1.amzn2.0.2.src  
  
x86_64:  
    cni-plugins-1.2.0-1.amzn2.0.2.x86_64  
    cni-plugins-debuginfo-1.2.0-1.amzn2.0.2.x86_64

Additional References

Red Hat: CVE-2022-41723

Mitre: CVE-2022-41723

Related

cbl_mariner 6
openvas 37
osv 31
veracode 2
nessus 60
fedora 16
redhat 9
ibm 13
amazon 6
github 1
debiancve 1
ubuntucve 2
redhatcve 2
redos 1
cve 2
alpinelinux 1
prion 1
nvd 2
cvelist 2
gitlab 1
wolfi 1
cgr 1
vulnrichment 1
cbl_mariner
cbl_mariner
CVE-2022-41723 affecting package kubevirt for versions less than 0.59.0-15
2024-03-21 08:09:05
CVE-2022-41723 affecting package skopeo for versions less than 1.12.0-3
2023-08-30 15:15:49
CVE-2022-41723 affecting package telegraf for versions less than 1.26.0-2
2023-04-16 01:05:11
openvas
openvas
Fedora: Security Advisory for gh (FEDORA-2023-cb20f08a4e)
2023-04-21 00:00:00
Fedora: Security Advisory for doctl (FEDORA-2023-3737bc1c0a)
2023-04-23 00:00:00
Fedora: Security Advisory for golang-github-cli-gh (FEDORA-2023-cb20f08a4e)
2023-04-21 00:00:00
osv
osv
CGA-7g3h-hc9h-8q9q
2024-06-06 12:24:57
BIT-golang-2022-41723
2024-03-06 10:57:47
golang-github-prometheus-prometheus-2.46.0-2.1 on GA media
2024-06-15 00:00:00
veracode
veracode
Denial Of Service (DoS)
2023-02-18 18:10:53
Denial Of Service (DoS)
2023-02-26 12:22:40
nessus
nessus
Fedora 37 : skopeo (2023-28c182b657)
2023-04-12 00:00:00
Amazon Linux 2 : amazon-ecr-credential-helper (ALASNITRO-ENCLAVES-2023-029)
2023-09-06 00:00:00
Amazon Linux 2023 : ecs-init (ALAS2023-2024-620)
2024-05-13 00:00:00
fedora
fedora
[SECURITY] Fedora 37 Update: golang-github-cli-gh-1.2.1-2.fc37
2023-04-20 02:54:37
[SECURITY] Fedora 37 Update: gh-2.27.0-1.fc37
2023-04-20 02:54:37
[SECURITY] Fedora 37 Update: golang-github-cenkalti-backoff-4.2.0-2.fc37
2023-04-20 02:54:37
redhat
redhat
(RHSA-2023:3305) Moderate: OpenShift Container Platform 4.13.1 security and extras update
2023-05-30 11:59:40
(RHSA-2024:0948) Moderate: OpenShift Container Platform 4.13.35 security update
2024-02-28 14:06:01
(RHSA-2023:7058) Moderate: rhc security, bug fix, and enhancement update
2023-11-14 08:44:18
ibm
ibm
Security Bulletin: IBM Storage Protect server is vulnerable to a denial of service attack due to Golang Go (CVE-2022-41723)
2023-06-20 16:04:54
Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to denial of service due to [CVE-2022-41723]
2023-11-30 13:02:04
Security Bulletin: A vulnerability in Golang Go package affects Data Replication on Cloud Pak for Data
2023-11-07 21:20:47
amazon
amazon
Important: rclone
2023-07-17 17:40:00
Important: docker
2023-10-30 23:31:00
Important: nerdctl
2023-08-03 18:10:00
github
github
golang.org/x/net vulnerable to Uncontrolled Resource Consumption
2023-02-17 14:00:02
debiancve
debiancve
CVE-2022-41723
2023-02-28 18:15:09
ubuntucve
ubuntucve
CVE-2022-41723
2023-02-28 00:00:00
CVE-2024-4436
2024-05-08 00:00:00
redhatcve
redhatcve
CVE-2022-41723
2023-03-14 23:43:00
CVE-2024-4436
2024-05-06 17:25:37
redos
redos
ROS-20231030-04
2023-10-30 00:00:00
cve
cve
CVE-2022-41723
2023-02-28 18:15:09
CVE-2024-4436
2024-05-08 09:15:09
alpinelinux
alpinelinux
CVE-2022-41723
2023-02-28 18:15:09
prion
prion
Code injection
2023-02-28 18:15:00
nvd
nvd
CVE-2022-41723
2023-02-28 18:15:09
CVE-2024-4436
2024-05-08 09:15:09
cvelist
cvelist
CVE-2022-41723 Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
2023-02-28 17:19:45
CVE-2024-4436 Etcd: incomplete fix for cve-2022-41723 in openstack platform
2024-05-08 08:57:12
gitlab
gitlab
Uncontrolled Resource Consumption
2023-02-17 00:00:00
wolfi
wolfi
CVE-2022-41723 vulnerabilities
2024-09-30 03:53:08
cgr
cgr
CVE-2022-41723 vulnerabilities
2024-05-19 03:07:16
vulnrichment
vulnrichment
CVE-2024-4436 Etcd: incomplete fix for cve-2022-41723 in openstack platform
2024-05-08 08:57:12

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

8

Confidence

High

EPSS

0.03

Percentile

91.0%

JSON
Related for ALAS2-2023-2192
cbl_mariner6openvas37osv31veracode2nessus60fedora16redhat9ibm13amazon6github1debiancve1ubuntucve2redhatcve2redos1cve2alpinelinux1prion1nvd2cvelist2gitlab1wolfi1cgr1vulnrichment1